From: Sabrina Dubroca <s...@queasysnail.net>
Date: Fri, 25 Aug 2017 13:10:12 +0200
> There are a few bugs around refcnt handling in the new BPF congestion
> control setsockopt:
>
> - The new ca is assigned to icsk->icsk_ca_ops even in the case where we
> cannot get a reference on it. This would lead to a use after free,
> since that ca is going away soon.
>
> - Changing the congestion control case doesn't release the refcnt on
> the previous ca.
>
> - In the reinit case, we first leak a reference on the old ca, then we
> call tcp_reinit_congestion_control on the ca that we have just
> assigned, leading to deinitializing the wrong ca (->release of the
> new ca on the old ca's data) and releasing the refcount on the ca
> that we actually want to use.
>
> This is visible by building (for example) BIC as a module and setting
> net.ipv4.tcp_congestion_control=bic, and using tcp_cong_kern.c from
> samples/bpf.
>
> This patch fixes the refcount issues, and moves reinit back into tcp
> core to avoid passing a ca pointer back to BPF.
>
> Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control")
> Signed-off-by: Sabrina Dubroca <s...@queasysnail.net>
Applied, thank you.
